How can I know where an Email really came from? Is there any way to find it out? I have heard about email headers, but I don't know where can I see email headers, in Gmail, for instance. Any help?
See below for an example of a scam that was sent to me, pretending to be from my friend, claiming she has been robbed and asking me for financial aid. I have changed the names — I am "Bill," and the scammer has sent an email to
First, in Gmail, click
The full email and its headers will open:
The headers are to be read chronologically from bottom to top — oldest are at the bottom. Every new server on the way adds its own message — starting with
This says that
Now, to find the real sender of your email, you must find the earliest trusted gateway — last when reading the headers from top. Let's start by finding Bill's mail server. For this, query MX record for the domain. You can use online tools like Mx Toolbox, or on Linux you can query it on command line (note the real domain name was changed to
And you'll see the mail server for domain.com is
You can trust this because it was recorded by Bill's mail server for
But be careful trusting that this is the real source of the email. The blacklist complaint could just be added by the scammer to wipe out his traces and/or lay a false trail. There is still the possibility that the server
Another point to keep in mind is that Alice uses Yahoo! (firstname.lastname@example.org) and
also there are some tools for analyzing email headers and extract email data for you,
I use http://whatismyipaddress.com/trace-email. If you use Gmail, click Show original (on More, next to the Reply button, copy the headers, paste them onto this website and click Get source. You'll get the Geo-location information and map in return
To find the IP address:
Click on the inverted triangle beside Reply. Select Show Original.
If you find more than one Received: from patterns, select the last one.
How you get to the headers varies between email clients. Many clients will let you see the original format of the message easily. Others (MicroSoft Outlook) make it more difficult.
To determine who really sent the message, the return-path is helpful. However, it can be spoofed. A Return-path address which does not match the From address is cause for suspicion. There are legitimate reasons for them to be different, such as messages forwarded from mailing lists, or links sent from web sites. (It would be better if the web-site used the Reply-to address to identify the person forwarding the link.)
To determine the origin of the message read from the top down through the received headers. There may be several. Most will have the IP address of the server they received the message form. Some issues you will encounter:
You should always be able to determine which server on the Internet sent the message to you. Tracing further back depends on the configuration of the sending servers.